Reallocate if transitioning fast-smi-only to fast-double from old space on x64.

src/x64/codegen-x64.cc

Index: src/x64/codegen-x64.cc
diff --git a/src/x64/codegen-x64.cc b/src/x64/codegen-x64.cc
index 2584889f087d56ff0fffd6f6521b47a7cf315326..c294611e188e2063d6788e4fd263c912ab414fcd 100644
--- a/src/x64/codegen-x64.cc
+++ b/src/x64/codegen-x64.cc
@@ -228,7 +228,7 @@ void ElementsTransitionGenerator::GenerateSmiOnlyToDouble(
   //  -- rsp[0] : return address
   // -----------------------------------
   // The fail label is not actually used since we do not allocate.
-  Label allocated, cow_array, only_change_map, done;
+  Label allocated, allocate_new, only_change_map, done;
 
   // Check for empty arrays, which only require a map transition and no changes
   // to the backing store.
@@ -242,7 +242,10 @@ void ElementsTransitionGenerator::GenerateSmiOnlyToDouble(
   __ SmiToInteger32(r9, FieldOperand(r8, FixedDoubleArray::kLengthOffset));
   __ CompareRoot(FieldOperand(r8, HeapObject::kMapOffset),
                  Heap::kFixedCOWArrayMapRootIndex);
-  __ j(equal, &cow_array);
+  __ j(equal, &allocate_new);
+  // If the source array is in old space, it is in pointer space, but we would
+  // expect a fast double array in data space, therefore we re-allocate.
+  __ JumpIfNotInNewSpace(r8, r14, &allocate_new);
   __ movq(r14, r8);  // Destination array equals source array.
 
   __ bind(&allocated);
@@ -273,8 +276,8 @@ void ElementsTransitionGenerator::GenerateSmiOnlyToDouble(
   // r15: the-hole NaN
   __ jmp(&entry);
 
-  // Allocate new array if the source array is a COW array.
-  __ bind(&cow_array);
+  // Allocate new array if the source array is a COW array or in old space.
+  __ bind(&allocate_new);
   __ lea(rdi, Operand(r9, times_pointer_size, FixedArray::kHeaderSize));
   __ AllocateInNewSpace(rdi, r14, r11, r15, fail, TAG_OBJECT);
   // Set receiver's backing store.